File name:

MsMpEng.exe

Full analysis: https://app.any.run/tasks/b2f2baec-263c-4857-ba82-c5c1185204e3
Verdict: Malicious activity
Analysis date: December 07, 2024, 07:11:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

F13F6F649888A7B93E4670EFE7564BB3

SHA1:

C0EA7812A3244147B74FEB43BD80B4CF56FF12FC

SHA256:

A69F26505D221F345E5AF11AEFBAECEEB62A217158C5787EA08B8C9337693D59

SSDEEP:

12288:Vf5nIZhcRrUyWoWvab27eiLLAAXmcoGZXrjGhUFw4tLRnzo4RI2Gg:Vf5nIZhcBUy9zb2aiLLAjtGZXz3BCg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • MsMpEng.exe (PID: 552)

    • Starts Visual C# compiler

      • MsMpEng.exe (PID: 552)

    • Changes the autorun value in the registry

      • ƓƆӸȜƱ.exe (PID: 848)

  • SUSPICIOUS

    • Uses .NET C# to load dll

      • MsMpEng.exe (PID: 552)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 1824)
      • MsMpEng.exe (PID: 552)

    • Reads security settings of Internet Explorer

      • MsMpEng.exe (PID: 552)

    • Reads the Internet Settings

      • MsMpEng.exe (PID: 552)

    • The process creates files with name similar to system file names

      • MsMpEng.exe (PID: 552)

    • Process drops legitimate windows executable

      • MsMpEng.exe (PID: 552)

    • Starts a Microsoft application from unusual location

      • svchost.exe (PID: 1792)

    • There is functionality for communication over UDP network (YARA)

      • svchost.exe (PID: 1792)

    • There is functionality for taking screenshot (YARA)

      • svchost.exe (PID: 1792)

  • INFO

    • Create files in a temporary directory

      • cvtres.exe (PID: 1332)
      • csc.exe (PID: 1824)
      • MsMpEng.exe (PID: 552)

    • Reads the machine GUID from the registry

      • MsMpEng.exe (PID: 552)
      • cvtres.exe (PID: 1332)

    • Checks supported languages

      • cvtres.exe (PID: 1332)
      • MsMpEng.exe (PID: 552)
      • csc.exe (PID: 1824)
      • ƓƆӸȜƱ.exe (PID: 848)
      • svchost.exe (PID: 1792)

    • Reads the computer name

      • MsMpEng.exe (PID: 552)
      • svchost.exe (PID: 1792)

    • The process uses the downloaded file

      • MsMpEng.exe (PID: 552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (81)
.dll | Win32 Dynamic Link Library (generic) (7.2)
.exe | Win32 Executable (generic) (4.9)
.exe | Win16/32 Executable Delphi generic (2.2)
.exe | Generic Win/DOS Executable (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:03:08 21:04:37+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 692224
InitializedDataSize: 3072
UninitializedDataSize: -
EntryPoint: 0xaae2e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: myfile2.exe
LegalCopyright:
OriginalFileName: myfile2.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msmpeng.exe csc.exe cvtres.exe no specs ɠɔӹȝʊ.exe svchost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
552"C:\Users\admin\AppData\Local\Temp\MsMpEng.exe" C:\Users\admin\AppData\Local\Temp\MsMpEng.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\msmpeng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
848"C:\Users\admin\AppData\Local\Temp\ƓƆӸȜƱ.exe" C:\Users\admin\AppData\Local\Temp\ƓƆӸȜƱ.exe
MsMpEng.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ɠɔӹȝʊ.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1108C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1332C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES786F.tmp" "c:\Users\admin\AppData\Local\Temp\CSC786E.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
1792C:\Users\admin\AppData\Local\Temp\svchost.exeC:\Users\admin\AppData\Local\Temp\svchost.exe—MsMpEng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\users\admin\appdata\local\temp\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1824"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\x_suzkgg.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
MsMpEng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 527
Read events
1 512
Write events
15
Delete events
0

Modification events

(PID) Process:(1108) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
525400363EFF
(PID) Process:(848) ƓƆӸȜƱ.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft Essentials
Value:
C:\Users\admin\AppData\Local\Temp\MsMpEng.exe
(PID) Process:(552) MsMpEng.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(552) MsMpEng.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(552) MsMpEng.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(552) MsMpEng.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
2
Suspicious files
2
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1332cvtres.exeC:\Users\admin\AppData\Local\Temp\RES786F.tmpbinary
MD5:C085B632BD65B426A53614C06C66F605
SHA256:DF0A9CC37B205B6B40D1A5DE9FABFDC456C377981F5FEA3BB67FAB04D6D441D0
552MsMpEng.exeC:\Users\admin\AppData\Local\Temp\x_suzkgg.0.cstext
MD5:5F1F61F2DF5242E34F9045AB5065C1DC
SHA256:6487668D8D8B602532CA5AE86468B54FA39B6E4D4CC1F754CE9536B3C6FD89F8
552MsMpEng.exeC:\Users\admin\AppData\Local\Temp\x_suzkgg.cmdlinetext
MD5:8F4764F7C74724FF54E7980294D51C82
SHA256:5024008DE3CD489B774BDC3885E55397E99B290BAFF2B8BF8A221F1A12E133A3
1824csc.exeC:\Users\admin\AppData\Local\Temp\ƓƆӸȜƱ.exeexecutable
MD5:34B010170D338FD7784EA10A5DA1C691
SHA256:B8A371D0303143D0F5D0A43696ABB6B322F3CD8A4A868F6C7DAE92A6F0DFAFE8
1824csc.exeC:\Users\admin\AppData\Local\Temp\CSC786E.tmpbinary
MD5:266E219BCE91DC9CC7241692F1277990
SHA256:E07BAFBE665810BD6C2AADE5015911B8896E9953831EFFB444B453F6D4CF19EE
552MsMpEng.exeC:\Users\admin\AppData\Local\Temp\svchost.exeexecutable
MD5:200FC355F85ECD4DB77FB3CAB2D01364
SHA256:C97F276B4C70682C8F8D39B91E30F938BC6E86A42CD6B71E3AD08092DBA528E9
1824csc.exeC:\Users\admin\AppData\Local\Temp\x_suzkgg.outtext
MD5:F68FF8ECD16C1B2482DB6725FE6F7EF1
SHA256:64E4F821E9ED7450D3E20B8B22507BE498C5EF77FEBFFDC421678AA2BB0779F1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
2
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
ratattack.sytes.net
  • —
unknown

Threats

PID
Process
Class
Message
1108
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.sytes.net Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MsMpEng.exe